CVE-2026-60849 is a vulnerability in the Oracle Unified Directory component of Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The flaw allows a low privileged attacker with network access via LDAP to compromise the Oracle Unified Directory, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 8.5, indicating high impact on confidentiality, integrity, and availability. The attack complexity is high, and no user interaction is required. The vulnerability also has a scope change, meaning it may impact additional Oracle products beyond Oracle Unified Directory. Oracle has included fixes for this vulnerability in its August 2026 Critical Security Patch Update.

Successful exploitation can result in complete takeover of Oracle Unified Directory, impacting confidentiality, integrity, and availability of the system. Due to scope change, other Oracle products relying on Oracle Unified Directory may also be significantly impacted.

Oracle has released a Critical Security Patch Update in August 2026 that includes fixes for this vulnerability. Customers are strongly advised to apply the available security patches promptly. Oracle recommends staying on actively-supported versions and applying patches without delay to prevent exploitation. No additional mitigation steps are specified beyond applying the official patches.